xzblib0[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
xzblib0.dll.exe
Size 11.8MB
Sample261024-2lpb5axves
SHA256 aa2dac35eec9f05c91eac1a3f9abf8f3d3f42023a91b2487ee03fb18d40aca7e
MD5 841d3be75d4488e9f25bfe2f3e1114a3
SHA1 4c6d6d5d7051a83dd769f9d65e4c6ab76a33dae7
SHA512 1b77a3ddb483a301182aefc32c1934ba5f4f82ebb46aed979f6443b3f207d146da45b3598c9381ed47bd977d670fa9f531f5ba81db9a123d9757aaf9d8917c1f
SSDEEP 196608:mEQETp0PBvtDCOSbAnqcaUuTwnJ7i72wGkYTUFuxBkxTMr:j/N0PuOWAnqW7ikwFuxiw
TLSH
T1A7C623D95AD242F4D0D30610728A439AB481A64D86FD1C293DD62C462B5DCBF628FFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
xzblib0.dll.exe

File Explorer

xzblib0.dll.exe

.dll 11.8MB

xzblib0.dll.exe

IMPHASH 23359b5a2488fdb9d279b1ead9561c4e
SHA256 aa2dac35eec9f05c91eac1a3f9abf8f3d3f42023a91b2487ee03fb18d40aca7e
MD5 841d3be75d4488e9f25bfe2f3e1114a3
SHA1 4c6d6d5d7051a83dd769f9d65e4c6ab76a33dae7
SHA512 1b77a3ddb483a301182aefc32c1934ba5f4f82ebb46aed979f6443b3f207d146da45b3598c9381ed47bd977d670fa9f531f5ba81db9a123d9757aaf9d8917c1f
SSDEEP 196608:mEQETp0PBvtDCOSbAnqcaUuTwnJ7i72wGkYTUFuxBkxTMr:j/N0PuOWAnqW7ikwFuxiw
TLSH
T1A7C623D95AD242F4D0D30610728A439AB481A64D86FD1C293DD62C462B5DCBF628FFFB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14141887

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

Virtual Size

70B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspr0

Size

Virtual Size

7.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.aspr1

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspr2

Size

11.8MB

Virtual Size

11.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

xzblib0.dll.exe

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic